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(54) Wireless subscriber terminal programming using a broadcast control channel 



(57) The invention is a system for programming 
wireless subscriber terminals (WST's) using a broad- 
cast channel of a wireless communication system. A 
control program, for controlling operation of the WST, is 
updated using a series of messages transmitted from a 
base station over a broadcast control channel to one or 
more WST's simultaneously. Each message in the se- 
ries contains a segment of the control program, and the 
series of messages is interleaved with other control data 
on the broadcast control channel in order to avoid inter- 



ference with other call activities. When a WST identifies 
a message as containing a control program segment, 
the WST stores the segment. Once a complete control 
program has been received, control of the WST can be 
transferred to the new control program. Receipt of the 
broadcast transmission is subject to interruption for a 
variety of reasons, e.g., a WST is powered off, a WST 
moves outside the range of a base station, other radio 
signals or noise interfere with the broadcast signal, or a 
call is received by a WST, which then transfers to a voice 
channel. 
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Description 

[0001 ] The invention relates to wireless systems, and 
more particularly to the reprogramming of wireless sub- 
scriber terminals in a wireless system using a broadcast s 
control channel. 

[0002] A wireless subscriber terminal ("WST"), also 
known as a "subscriber" or a "mobile unit," is any mobile 
or fixed station providing a subscriber's point of interface 
to a wireless system, typically a cellular or wireless local 10 
loop system. WST's within the wireless system commu- 
nicate with a base station, which manages calls across 
an air interface by subdividing the available spectrum 
into a number of voice channels and control channels. 
The voice channels carry voice signals and other data. '5 
The control channels carry information needed to man- 
age the voice channels. Broadcast control channels are 
used to simultaneously transmit information to all of the 
terminals within range of a base station, as distin- 
guished from other voice/control channels that operate 20 
on a point-to-point basis. The present invention relates 
to a system for programming WST's over a wireless sys- 
tem using a broadcast control channel. 
[0003] As telephony techniques have advanced, 
WST's have become increasingly sophisticated. In ad- 25 
dition to radio frequency modulation/demodulation cir- 
cuitry for transmitting and receiving signals over a wire- 
less channel, WST's typically include signal processing 
for transforming audio information between analog and 
digital representations. A microprocessor or microcon- 30 
trailer is also included, both for controlling the voice 
channel hardware and for providing higher level func- 
tions accessible to a WST user. These higher level func- 
tions, or "features," include those functions familiar to 
the typical cellular phone user, such as a call-in-absence 35 
indicator, theft alarm, call restrictions, hands-free oper- 
ation, and handset attributes such as a phone number, 
security code, and ringer/alert capability. 
[0004] The microprocessor/microcontroller requires 
its own software to control initialization of the hardware 40 
when the WST is turned on, and to control operation of 
the WST while it remains on. This software, referred to 
here as a control program, is stored in a non-volatile 
memory so that it remains intact until actively erased. 
Ordinarily, the control program is installed by the WST 45 
manufacturer before delivery. The non-volatile memory 
also typically contains programmable data relating to 
the identity of the particular WST and the feature set- 
tings for the WST. This programmable data is ordinarily 
entered by a technician prior to delivery to an end user. 50 
[0005] The configuration options for WST features 
can also be programmed remotely. One approach is dis- 
closed in the specification of U.S. Patent No. 5,1 09,403, 
in which features are activated over a voice channel us- 
ing tones. In another approach, control channels are 55 
used to update WST features. While improving the ver- 
satility of wireless systems, these approaches are con- 
strained to setting feature switches, which are then in- 



terpreted by the control program to provide features to 
a WST user. They do not permit replacement of the con- 
trol program itself. 

[0006] As control programs and available features 
change with the passage of time, it is sometimes desir- 
able to update the entire control program associated 
with a WST, as distinguished from pre-defined features. 
One method of updating control programs is disclosed 
in the specification of U.S. Patent No. 5,430,877. This 
approach uses a physical connection to update soft- 
ware. Another approach to reprogramming is disclosed 
in the specification of U.S. Patent No. 5,666,293. 
[0007] There remains a need for a system to program 
WST's, i.e., suitable to wireless telephony, that permits 
complete flexibility in WST programming/ reprogram- 
ming from a remote program database. 
[0008] The present invention includes a method for 
programming wireless subscriberterminals in a wireless 
system, the wireless system having a base station in 
wireless communication with the wireless subscriber 
terminals using one or more control channels and mul- 
tiple traffic channels, and each wireless subscriber ter- 
minal having a memory, a non-volatile memory, a proc- 
essor, and an original control program running on the 
processor to control operation of the wireless subscriber 
terminal, characterized by the steps of: 

A. initializing one or more participating wireless sub- 
scriber terminals from the base station, using a con- 
trol channel, to receive a complete program over a 
selected control channel; 

B. transmitting a complete program from the base 
station using the selected control channel, the com- 
plete program comprising a plurality of program 
segments communicated to the wireless subscriber 
terminals in separate messages; 

C. verifying that each participating wireless sub- 
scriber terminal has received the complete pro- 
gram; 

D. storing the complete program in the non-volatile 
memory of each participating wireless subscriber 
terminal as a new control program; and 

E. transferring control of each participating wireless 
subscriber terminal to the new control program. 

[0009] The invention also includes a system for pro- 
gramming wireless subscriber terminals, the system 
comprising: 

a base station, the base station having a memory; 
a control program stored in the memory of the base 
station; 

one or more wireless subscriber terminals in wire- 
less communication with the base station over an 
air interface, the air interface comprising a plurality 
of traffic channels and a plurality of control chan- 
nels; 

means for initializing the one or more wireless sub- 
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scriber terminals, using the control channels, to re- 
ceive the control program; 
means for broadcasting the control program to the 
one or more wireless subscriber terminals; 
means for verifying that each initialized wireless 
subscriber terminal has received the control pro- 
gram; and 

means for transferring control of each initialized 
wireless subscriber terminal to the control program. 

[001 0] Conveniently, the control program in a wireless 
subscriber terminal is updated by means of control 
channel transmissions from a base station. The control 
program is transmitted as a series of messages contain- 
ing program segments, interleaved with other messag- 
es on a broadcast control channel. When a WST iden- 
tifies a message as belonging to a control program ap- 
plicable to the WST, the WST stores the program seg- 
ment contained in the message. 
[0011 ] Reception of the broadcast control channel by 
a WST can be interrupted by, for example, radio inter- 
ference, powering down, or movement of a WST beyond 
the range of a base station. Further, the WST must drop 
the broadcast control channel and switch to a different 
physical channel for voice/data traffic. Thus the WST is 
not always in a condition to receive program messages. 
To address this problem, the base station arbitrates the 
transmission of unreceived program segments by poll- 
ing individual WST's participating in the control program 
broadcast and retransmitting program segments 
missed by any of the WST's. 

[0012] The system preferably provides non-volatile 
storage of partial programs in each WST so that a WST 
need not receive an entire program in a single session. 
[0013] Thus the invention advantageously accom- 
plishes remote WST reprogramming in a manner that 
avoids use of the voice channels, and in a manner that 
does not require a continuous, uninterrupted connection 
to the broadcast control channel. 
[001 4] The invention will now be described, by way of 
example, with reference to the accompanying drawings 
in which: 

Fig. 1 is a block diagram of a wireless communica- 
tion system; 

Fig. 2 is a block diagram of a base station; 

Fig. 3 is a block diagram of a wireless subscriber 

terminal; and 

Fig. 4 is a diagram of the message formats used in 
the invention. 

Fig. 5 is a data flow chart showing the flow of data 
between a base station and wireless subscriber ter- 
minals. 

[0015] Figure 1 depicts a wireless communication 
system 1 0 according to the present invention, in which 
a base station 20 is in two-way wireless communication 
with wireless subscriber terminals (WST's) 24, and in 



further two-way communication with a landline system 
25 via a trunk 26. The landline system 25 may be the 
public switched telephone network (PSTN), or any other 
wired network capable of voice/ data connections. If an 

s active call is present on the trunk 26, the base station 
20 translates the forward trunk signal to a properly for- 
matted radio signal which is radiated by an antenna 27 
to a WST 24 over the air interface 30. The WST 24 per- 
forms complementary operations to establish two-way 

10 voice connections over the air interface 30. 

[0016] The term "trunk," as used herein, refers to a 
conventional connection to a PSTN for carrying a plu- 
rality of telephone signals, and is further intended to in- 
clude a plurality of such trunks, an individual subscriber 

is line, or any other connection to a landline system 25. 
[0017] The terms such as "voice channel" and "voice 
traffic", as used herein, are intended to include the com- 
munication of conventional audio signals, as well as da- 
ta, such as facsimile or computer data, that might be 

20 carried by a telephone system 25. 

[001 8] The present invention includes an air interface 
30 having at least one control channel, distinct from the 
voice channels, which can provide broadcast communi- 
cation to numerous WST's 24, along with bi-directional 

25 control communication between individual WST's 24 
and the base station 20. The present invention is to be 
used primarily with a wireless local loop installed as an 
alternative to a landline, the communication system 10 
may also be a cellular or macro/micro-cellular system 

30 designed for mobile telephony and that certain adapta- 
tions may be made for such cellular applications. 
[001 9] The invention will be used with more, emerging 
standards such as GSM, PCS, and third generation 
standards derived from the IMT-2000 program. The fol- 

35 lowing embodiment of the invention uses the digital sec- 
tor of the air interface 30 described by the Telecommu- 
nications Industry Association's IS-136 specification 
(IS-136). Briefly stated, the digital sector of IS-136 is a 
digital, time division multiple access (TDMA) technology 

40 operating on 800 MHz and 1 900 MHz. 

[0020] As shown in Fig. 1 , the IS-1 36 air interface 30 
includes digital traffic channels 32 which are two-way 
links for voice traffic. The air interface 30 also includes 
a digital control channel (DCCH) 34 having (logical) 

45 broadcast control channels for broadcasting information 
from the base station 20 to numerous WST's. The 
DCCH 34 also includes several (logical) point-to-point 
control channels for direct, two-way control communi- 
cation between each WST 24 and the base station 20. 

so This combination of control channels can be advanta- 
geously employed to effectively transmit an entire con- 
trol program to several participating WST's 24 while 
conserving the typically limited digital traffic channels 32 
for voice traffic between the landline system 25 and the 

55 WSTs24. 

[0021] As shown in Fig. 2, the base station 20 pro- 
vides an interface between the landline system 25 and 
the WST's 24. In order to function in this capacity, the 
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base station 20 includes a MUX/switch 50 on one hand 
to transmit and receive wired network voice traffic, and 
a radio frequency (RF) system 60 connected to the an- 
tenna 27 on the other hand to transmit and receive wire- 
less voice traffic across the air interface 30. A wireless 
access controller (WAC) 70 manages the operations of 
the RF system 60 and the MUX/switch 50 to ensure that 
each wired voice connection is coupled to the correct 
channel of the air interface 30. The WAC 70 also per- 
forms functions related to voice encoding, compression, 
encryption, and security. 

[0022] With respectto the present invention, the WAC 
70 performs several specific functions. First the WAC 
70 manages the transmission of a control program over 
the broadcast control channel. The control program is 
stored in a memory 80 in the base station 20. In order 
to transmit the control program to the WSTs 24, the 
WAC 70 divides the control program into program seg- 
ments which can be interleaved with other broadcast 
control channel transmissions, i.e., transmitted between 
other control messages so as to avoid interfering with 
ordinary operations of the wireless system 10. When it 
is desired to update the control program for the WST's 
that is stored in the memory 80 of the base station 20, 
for example, over the landline system 25, the wireless 
access controller 70 also manages the receipt of the 
control program over a trunk 26 and storage of the con- 
trol program in the memory 80. 
[0023] As shown in Fig. 3, a WST 24 transmits and 
receives signals through the air interface 30 using an 
antenna 1 00 coupled to an RF system 110. The demod- 
ulated voice signal, or some encoded representation 
thereof, is carried on a system bus 112 to a voice signal 
port 114. In the preferred wireless local loop embodi- 
ment, the voice signal port 114 is a modular jack com- 
patible with standard local loop telephone cords, along 
with any appropriate conversion circuitry. The WST 24 
also includes a processor 122 connected to the system 
bus 112 for controlling operation of the WST 24, as well 
as a memory 124 for temporary storage and a non-vol- 
atile memory 126 for storage of a WST control program. 
[0024] The control program consists of a series of in- 
structions which the processor 122 can execute to con- 
trol operation of the WST 24. The term "firmware", as 
used in the following discussion, is intended to refer to 
an executable firmware image for use with a microcon- 
troller, as well as any other executable code, instruc- 
tions, or other software that might be used as a control 
program for a WST 24. Reprogramming the WST 24 
with a new control program comprises four general 
steps: (1) initialization, (2) program broadcast, (3) veri- 
fication, and (4) switch-over. These steps are now de- 
scribed in detail. 

1 . Initialization: 

[0025] Before broadcast transmission of a new con- 
trol program, the base station 20 directly initializes each 



WST 24 by sending each WST 24 a broadcast firmware 
start (BFS) message 150 over a forward point-to-point 
control channel. Figure 4 shows the format of the BFS 
message 150, which is used by each WST 24 to deter- 
5 mine whether it should participate in the upcoming con- 
trol program broadcast. The SFSmessage 1 50 includes 
a hardware model number 152, a hardware version 
number 1 54, a firmware version number 1 56 for the par- 
ticular control program, and a feature set identifier 158. 
io Each WST 24 compares this information with stored in- 
formation to determine whether it should receive the im- 
pending control program broadcast. 
[0026] The BFS message 1 50 also includes informa- 
tion which participating WST's 24 use to handle the sub- 
's sequent broadcast messages containing the new con- 
trol program. A transfer identifier 1 60 uniquely identifies 
the control program broadcast The same identification 
number is also included in all of the broadcast messages 
containing the new control program so that each WST 
20 24 can recognize them. A force transfer flag 1 62 can 
direct the recipient WST 24 to load the new control pro- 
gram even when the WST 24 already has a matching 
firmware version number 1 56. An automatic switch-over 
flag 1 64 can be used to instruct the WST 24 to automat- 
es ically transfer control to the new control program once 
a complete program has been received. If the automatic 
switch-over flag 1 64 is not set, then the WST 24 waits 
for a command from the base station 20 to switch to the 
new control program. 
30 [0027] Further flexibility is provided by including, in 
the BFS message 150, a block size field 166 and a 
number-of-blocks field 168. By transmitting these pa- 
rameters, the base station can adjust message lengths 
for a particular control program broadcast. 
35 [0028] Each WST 24 receiving the BFS message 1 50 
replies with its own BFS response (BFSR) message 
1 80. This is a simple two-part message transmitted over 
a reverse control channel. The BFSR message 1 80 in- 
cludes the transfer identifier 1 60 from the BFS message 
40 1 50, and a response code 1 84 which indicates whether 
the WST 24 will participate in the pending control pro- 
gram transfer. 

[0029] The base station 20 receives a BFSRmessage 
1 80 from each WST 24. This information is stored in the 
45 memory 80 of the base station 20 for use during the re- 
programming. At this point, initialization is complete and 
the base station 20 may initiate a control program broad- 
cast. 

50 2. Control Program Broadcast: 

[0030] The base station 20 transmits segments of the 
new control program using broadcast firmware block 
(BFB) messages 190 transmitted over a broadcast 
55 channel. Each BFB message 1 90 has three parts. The 
transfer identifier 1 60 is again used to uniquely identify 
the control program broadcast. A block number 194 is 
included to allow for proper sequencing of control pro- 
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gram blocks. And, of course, the firmware block 196 it- 
self is included in the BFB message 1 90. The length of 
the firmware block 1 96 is specified in the (previously 
transmitted) BFS message 150. The BFB messages 
190 are interleaved with other broadcast channel trans- 
missions within a logical channel so as to permit other 
broadcast channel traffic required for normal operation 
of the wireless communication system 10. 
[0031] The base station 20 continues broadcasting 
BFB messages 1 90 until it has transmitted a complete 
control program. If the broadcast channel was an error 
free, uninterrupted communication medium, this would 
conclude the firmware transfer. However, there is no 
guarantee that every BFB message 1 90 reaches every 
participating WST24. Any number of events may cause 
a WST 24 to miss BFB messages 1 90, including a user 
powering off the WST 24, interference in the air inter- 
face, equipment failure, or the WST 24 switching to a 
digital traffic channel 32 for normal call activities. Thus 
the wireless system proceeds to verify the control pro- 
gram broadcast. 

3. Verification: 

[0032] In order to verify the firmware broadcast, the 
base station 20 polls all of the participating WST's 24 
using broadcast firmware status request (BFSReq) 
messages 200, transmitted over one or more forward 
point-to-point control channels. Each BFSReq message 
200 includes no message other than its own request for 
status information. 

[0033] Each WST 24 responds to the BFSReq mes- 
sage 200 using a broadcast firmware status (BFStat) 
message 210, transmitted to the base station 20 over a 
reverse control channel. The BFStat message 21 0 in- 
cludes a status code 21 2 indicating the status of the re- 
ceived control program, e.g., transfer incomplete, trans- 
fer complete, transfer and switch-over complete. The 
status code 212 may also contain information available 
from WST 24 self-tests, such as a hardware failure or 
unsuccessful switch-over while attempting to use the 
new control program. These self-tests are described be- 
low in reference to the switch-over to a new control pro- 
gram, but they may be conducted before or after the 
WST 24 receives a BFSReq message 200. 
[0034] As with the other messages, the BFStat mes- 
sage 210 includes the transfer identifier 160. Using a 
blocks received field 216 in the BFStat message 210, 
the WST 24 also informs the base station 20 of the 
number of blocks successfully received. Finally, the 
BFStat message 21 0 includes a missing block mask 21 8 
for identifying those blocks which have not been re- 
ceived. The missing block mask 218 is a multi-bit mask 
in which each bit represents a series of control program 
blocks. In a preferred embodiment, the mask is 64 bits 
long and each bit is mapped to a sequential, integer 
number of blocks representing approximately one sixty- 
fourth of the entire block range. By coding and decoding 



the missing blocks in this manner with a predetermined 
formula, each WST 24 can quickly and efficiently inform 
the base station 20 of block ranges in which there are 
blocks missing. 

5 [0035] At this point, the base station 20 retransmits 
any missing control program blocks. The collective 
BFStat messages 21 0 received by the base station 20 
provide a complete picture of which blocks are missing 
from which WST's 24 within the wireless system 1 0. In 

10 order to fill these gaps, the base station 20 may employ 
a number of strategies. The base station 20 may simply 
re-broadcast a complete set of missing blocks, or the 
base station 20 may individually transmit blocks to each 
WST 24 using forward point-to-point control channels. 

15 Where a single WST 24 has missed a significant number 
of blocks, it may even be desirable to transmit a set of 
missing blocks using a (higher data rate) digital traffic 
channel. Alternatively, the base station 20 may analyze 
the distribution and symmetry of missing blocks to select 

20 some mix of these two strategies which optimizes air 
interface traffic and/or speed. Any methodology can be 
employed, provided each participating WST 24 has a 
complete control program prior to switch-over. 

25 4. Switch-over: 

[0036] The final message type of the reprogramming 
protocol is a firmware switch-over message 220, trans- 
mitted from the base station 20 to a WST 24 using a 

30 forward point-to-point channel. Upon receipt of the 
firmware switch-over message 220, the WST 24 stores 
the complete new control program in non-volatile mem- 
ory 126 and transfers control to the new control pro- 
gram. Optionally, the switch-over may be automatic, as 

35 when the automatic switch-over flag 164 is set in the 
initial BFS message 1 50. 

[0037] The old control program is retained after the 
switch-over. When the WST 24 first transfers control to 
the new control program, a series of internal verification 

40 tests are performed to ensure that the new control pro- 
gram is operating correctly. This includes conventional 
power-on self tests of memory 124 and system bus 112 
input/ outputs. Each item of hardware used by the con- 
trol program, e.g., the RF unit 110, is also tested to en- 

45 sure that it is present and responding to the processor 
122. If the power-on tests are successfully completed, 
the WST 24 then attempts to access the broadcast con- 
trol channel used by the base station 20, using the new 
control program. If any of these tests are failed, the new 

50 control program is rejected and the WST 24 restores the 
old control program. If all of these tests are successfully 
completed, the new control program is marked as "ac- 
cepted" (so that subsequent WST power-on's do not re- 
sult in an inappropriate rejection of the new control pro- 

55 gram), and control of the WST 24 is unconditionally 
transferred to the new control program. 
[0038] Figure 5 shows the flow of data according to 
the programming method described above. The base 
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station 20 and each WST 24 are shown as vertical lines. 
The horizontal lines indicate data flow between the base 
station 20 and each WST 24, with arrows indicating the 
direction of data flow. The initialization 240 comprises a 
BFS message 1 50 transmitted from the base station 20 s 
to each WST 24 on a point-to-point basis. Once each 
participating WST 24 has responded with a BFSR mes- 
sage 180, the base station performs a control program 
broadcast 250 by broadcasting the BFB messages 1 90 
containing control program blocks. It will be noted that 10 
each BFB message 190 is a single broadcast transmis- 
sion to all of the participating WST's 24. After all of the 
BFB messages 1 90 have been transmitted, The base 
station 20 performs a verification 260 of the broadcast 
This comprises BFSReq messages 200 from the base '5 
station 20 to each WST 24 on a point-to-point channel, 
and a responsive BFStat message 210 from each WST 
24 to the base station 20. Where firmware switch-over 
is controlled from the base station 20, a final switch-over 
step 270 is performed by a Firmware Switch-Over mes- 20 
sage 220 from the base station 20 to each participating 
WST 24. 

[0039] A number of variations to this reprogramming 
system are possible once the basic update system is in 
place. Each WST 24 may store multiple control pro- 25 
grams for use at different times, with the base station 
20 controlling each switch-over as needed. Further, the 
reprogramming system may be used to provide soft- 
ware patches, that is, individual blocks of a control pro- 
gram may be replaced without replacing the entire im- 30 2. 
age. 

[0040] The invention is a system for programming 
wireless subscriber terminals (WST's) using a broad- 
cast channel of a wireless communication system. A 
control program, for controlling operation of the WST, is 35 
updated using a series of messages transmitted from a 
base station over a broadcast control channel to one or 
more WST's simultaneously. Each message in the se- 
ries contains a segment of the control program, and the 
series of messages is interleaved with other control data 40 
on the broadcast control channel in order to avoid inter- 
ference with other call activities. When a WST identifies 
a message as containing a control program segment, 
the WST stores the segment. Once a complete control 
program has been received, control of the WST can be 45 3. 
transferred to the new control program. Receipt of the 
broadcast transmission is subject to interruption for a 
variety of reasons, e.g., a WST is powered off, a WST 
moves outside the range of a base station, other radio 
signals or noise interfere with the broadcast signal, or a 50 
call is received by a WST, which then transfers to a voice 
channel. 



Claims 55 

1 . A method for programming wireless subscriber ter- 
minals in a wireless system, the wireless system 



having a base station in wireless communication 
with the wireless subscriber terminals using one or 
more control channels and multiple traffic channels, 
and each wireless subscriber terminal having a 
memory, a non-volatile memory, a processor, and 
an original control program running on the proces- 
sor to control operation of the wireless subscriber 
terminal, characterized by the steps of: 

A. initializing one or more participating wireless 
subscriber terminals from the base station, us- 
ing a control channel, to receive a complete 
program over a selected control channel; 

B. transmitting a complete program from the 
base station using the selected control channel, 
the complete program comprising a plurality of 
program segments communicated to the wire- 
less subscriber terminals in separate messag- 

C. verifying that each participating wireless 
subscriber terminal has received the complete 
program; 

D. storing the complete program in the non-vol- 
atile memory of each participating wireless sub- 
scriber terminal as a new control program; and 

E. transferring control of each participating 
wireless subscriber terminal to the new control 
program. 

A method as claimed in claim 1 , characterized by 
the step of verifying including the steps of polling 
each participating wireless subscriber terminal, us- 
ing one or more control channels, to determine 
whether any participating wireless subscriber termi- 
nals have not received any program segments; re- 
transmitting from the base station the program seg- 
ments that any participating wireless subscriber ter- 
minals have not received, the unreceived program 
segments are retransmitted over one or more point- 
to-point control channels, and the unreceived pro- 
gram segments are retransmitted over one or more 
broadcast control channels, or retransmitted over 
one or more traffic channels. 

A method as claimed in claim 1 , characterized by 
the step of verifying comprises the step of perform- 
ing a series of diagnostic tests at each participating 
wireless subscriber terminal to determine the valid- 
ity of the new control program received at that wire- 
less subscriber terminal, and including the step of 
storing each program segment received by the 
wireless subscriber terminal in the non-volatile 
memory of the wireless subscriber terminal, so that 
the wireless subscriber terminal retains all received 
program segments if reception of program seg- 
ments by the wireless subscriber terminal is inter- 
rupted 
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4. A method as claimed in claim 1 characterized by 
the step of storing the original control program in 
non-volatile memory after transferring control of the 
processor to the new control program. 

5 

5. A method as claimed in any one of claims 1 to 4 
characterized by the control program and the new 
control program each comprise a software patch for 
controlling less than all of the operations of the wire- 
less subscriber terminal, and preferably the wire- 10 
less subscriber terminal is a cellular phone. 

6. A method as claimed in claim 5 characterized by 
the wireless subscriber terminal is a terminal of a 
wireless local loop, and the step of transferring con- 15 
trol to the new control program is forced by the base 
station during the step of initializing each wireless 
subscriber terminal. 

7. A system for programming wireless subscriber ter- 20 
minals, the system comprising: 

a base station, the base station having a mem- 
ory; 

a control program stored in the memory of the 25 
base station; 

one or more wireless subscriber terminals in 
wireless communication with the base station 
over an air interface, the air interface compris- 
ing a plurality of traffic channels and a plurality so 
of control channels; 

means for initializing the one or more wireless 
subscriber terminals, using the control chan- 
nels, to receive the control program; 
means for broadcasting the control program to 35 
the one or more wireless subscriber terminals; 
means for verifying that each initialized wire- 
less subscriber terminal has received the con- 
trol program; and 

means for transferring control of each initialized 10 
wireless subscriber terminal to the control pro- 
gram. 

8. A system as claimed in claim 7, characterized in that 
the one or more wireless subscriber terminals com- 45 
prise cellular phone handsets, and preferably the 
one or more wireless subscriber terminals comprise 
wireless local loop terminals. 

9. A base station for programming one or more wire- so 
less subscriber terminals in a wireless system, the 
base station comprising a memory, a control pro- 
gram stored in the memory as one or more program 
segments, a transmitter for transmitting forward 
messages to wireless subscriber terminals over an 55 
air interface, the forward messages including the 
one or more program segments stored in the mem- 
ory, a receiver for receiving reverse messages from 



wireless subscriber terminals over the air interface, 
a processor connected to the memory, the transmit- 
ter, and the receiver for controlling operation of the 
base station, the forward messages including 
broadcast firmware start messages and the reverse 
messages including broadcast firmware start re- 
sponse messages. 

10. A base station as claimed in claim 9 characterized 
in that the forward messages including broadcast 
firmware status request messages and the reverse 
messages including broadcast firmware status 
messages. 

11. A method for operating a base station to program 
one or more wireless subscriber terminals in a wire- 
less system, the method comprising the steps of: 

A. initializing a plurality of wireless subscriber 
terminals, using a control channel, to receive a 
control program; 

B. broadcasting the control program to the plu- 
rality of wireless subscriber terminals; 

C. verifying that each one of the plurality of 
wireless subscriber terminals has received the 
control program; 

D. transferring control of each one of the plu- 
rality of wireless subscriber terminals to the 
control program; and 

E. transmitting a broadcast firmware start mes- 
sage to each wireless subscriber terminal over 
one or more forward channels and receiving a 
broadcast firmware start response message 
from one or more participating wireless sub- 
scriber terminals over one or more reverse 
channels. 

12. A method as claimed in claim 11 characterized by 
the step of broadcasting including the step of trans- 
mitting one or more broadcast firmware block mes- 
sages over a broadcast channel, and transmitting a 
broadcast firmware status request message to one 
or more participating wireless subscriber terminal 
over one or more forward channels, receiving a 
broadcast firmware status message from one or 
more of the one or more participating wireless sub- 
scriber terminals, and retransmitting any missing 
program segments to the one or more participating 
wireless subscriber terminals. 

13. A wireless subscriber terminal for use in a wireless 
system, the terminal comprising a memory, a trans- 
mitter for transmitting reverse messages from the 
terminal over an air interface, a receiver for receiv- 
ing forward messages from a base station, the for- 
ward messages including the one or more program 
segments, a processor connected to the memory, 
the transmitter, and the receiver for controlling the 
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terminal, and for storing the one or more program 
segments in the memory, in which the forward mes- 
sages include broadcast firmware start messages 
and the reverse messages include broadcast 
firmware start response messages, and the forward 5 
messages also include broadcast firmware status 
request messages and the reverse messages in- 
clude broadcast firmware status messages, with 
the forward messages include firmware switch-over 
messages, and the forward messages including the to 
one or more program segments are broadcast mes- 
sages. 

1 4. A method for operating a wireless subscriber termi- 
nal in a wireless system to receive a control pro- is 
gram, the method comprising the steps of initializing 
a terminal, using a control channel, to receive a con- 
trol program, the control program comprising a plu- 
rality of control program segments, receiving a 
broadcast comprising the plurality of control pro- 20 
gram segments, verifying that the terminal has re- 
ceived all of the control program segments, trans- 
ferring control of the terminal to the control program, 
including the step of initializing further comprising 
the steps of receiving a broadcast firmware start 25 
message over a forward channels and transmitting 
a broadcast firmware start response message over 
a reverse channel, the step of receiving a broad- 
casting further comprising the step of receiving a 
plurality of firmware block messages over a broad- 30 
cast channel, the step of verifying including the 
steps of, receiving a broadcast firmware status re- 
quest message over a forward channels, transmit- 
ting a broadcast firmware status message over a 
reverse channel, the broadcast firmware status 35 
message identifying any missing control program 
segments, receiving any missing control program 
segments identified in the broadcast firmware sta- 
tus message, and the step of transferring control 
further comprising the step of receiving a firmware <*o 
switch-over message. 
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(57) The invention is a system for programming 
wireless subscriber terminals (WST's) using a broad- 
cast channel of a wireless communication system. A 
control program, for controlling operation of the WST, is 
updated using a series of messages transmitted from a 
base station over a broadcast control channel to one or 
more WST's simultaneously. Each message in the se- 
ries contains a segment of the control program, and the 
series of messages is interleaved with other control data 
on the broadcast control channel in order to avoid inter- 



ference with other call activities. When a WST identifies 
a message as containing a control program segment, 
the WST stores the segment. Once a complete control 
program has been received, control of the WST can be 
transferred to the new control program. Receipt of the 
broadcast transmission is subject to interruption for a 
variety of reasons, e.g., a WST is powered off, a WST 
moves outside the range of a base station, other radio 
signals or noise interfere with the broadcast signal, or a 
call is received by a WST, which then transfers to a voice 
channel. 
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